cc tedchoc, nasko.

This is pretty easy to fix, and I'd be happy to fix it, but given the broad impact of a change like this, I'd like your opinions.

Also more generally, have we put thought into side-channel attacks related to exposing high-accuracy accelerometer data to pages without input focus? I know ChromeOS tackled this type of problem by only providing low-fidelity accelerometer data while typing in passwords, but as far as I know android doesn't do this.

+aelias@ for general focus
+twellington@ for multiwindow

When Chrome is hidden, we call hide on the webcontents (Tab.java#onActivityHidden is called from onStopWithNative which is when the activity is fully hidden).  I'm surprised that doesn't implicitly result in a blur.

ContentViewCore already has onWindowFocusChanged, if we see that we have focus but the window loses focus, we could potentially send a blur (and refocus later as well).  I don't know all the implications of that and I'll defer to Alex there.

Seems OK to make that change.  I tested with example http://output.jsbin.com/luquqoh that iOS Safari sends a blur event when going to homescreen.  So Clank seems like the outlier.

> Also more generally, have we put thought into side-channel attacks related to exposing high-accuracy accelerometer data to pages without input focus?

Looks like timvolodine@ wrote the accelerometer code, he would know.

aelias@, are you willing to take this on (or find somebody who is)? This is definitely outside of my area of expertise.

Well, I might not have time to get to this in a while -- I'd prefer if you wrote the patch, and I'd be happy to answer questions and code review.  I'm sure you could quickly develop the necessary expertise with a bit of code search on how focus works (same as I'd need to do).  I generally encourage subprojects that are blocked on deeper problems in Chrome to go ahead and fix it themselves -- that scales better than everybody only writing patches in their code silos.

For hardware related apis like sensors we actually disable them when page is invisible. (not sure if this also applies to WebVR but would expect it should). Regarding 'side-channel' considerations I was actually working on this although it's not focus based at the moment.

Lowering priority as this only affect multi-window for VR. When the app is backgrounded we already stop sending pose data, so it's not as big of an issue that the page isn't blurred.

also cc'ing kochi@ for focus

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/460ffe75e23987ac6760d668963d9d2f1a83962b

commit 460ffe75e23987ac6760d668963d9d2f1a83962b
Author: mthiesse <mthiesse@chromium.org>
Date: Mon Apr 10 21:08:46 2017

[Android] Focus/Blur contents when window focus changes

This ensure that when an activity loses input focus (OnWindowFocusChanged), that the web page is blurred and not considered to be focused.

BUG= 686232 

Review-Url: https://codereview.chromium.org/2779033004
Cr-Commit-Position: refs/heads/master@{#463390}

[modify] https://crrev.com/460ffe75e23987ac6760d668963d9d2f1a83962b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
[modify] https://crrev.com/460ffe75e23987ac6760d668963d9d2f1a83962b/chrome/android/javatests/src/org/chromium/chrome/browser/ContentViewFocusTest.java
[add] https://crrev.com/460ffe75e23987ac6760d668963d9d2f1a83962b/chrome/test/data/android/content_view_focus/content_view_blur_focus.html
[modify] https://crrev.com/460ffe75e23987ac6760d668963d9d2f1a83962b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java

Noting for posterity that this doesn't precisely track input focus to the WebContents, so it's not exactly analogous to other platforms (due to popup views stealing input focus), but it should behave as users would expect.